squishit

Squish Site Patrol gives your WordPress site a complete health check — security hardening, malware scanning, login protection, and page speed in a single clean dashboard.
Two-Factor Authentication (2FA) 
* TOTP-based 2FA with QR code setup (Google Authenticator, Authy, etc.) 
* Custom branded interstitial login page — replaces the default wp-login.php flow 
* Per-user 2FA enrollment with recovery options
Login Protection 
* reCAPTCHA v3 on the login page (free tier, no checkbox required) 
* Geo IP country blocking — restrict logins by country via ipapi.co 
* Magic link login — send a one-time signed login link to your admin email (Patched) 
* Failed login attempt monitoring and alerts (Patched) 
* Detects predictable “admin” username
Security Checks 
* WordPress core version check 
* Plugin update status — flags outdated plugins 
* SSL / HTTPS detection 
* File editor status check (wp-admin editor) 
* wp-config.php permissions check (Patched) 
* XML-RPC status check (Patched) 
* Debug mode detection (Patched) 
* Admin account audit — flags inactive admin accounts (Patched) 
* Database prefix check — flags default wp_ prefix (Patched) 
* Directory listing detection (Patched) 
* HTTP security headers check (Patched)
Malware Scanner 
* Verifies all 3,000+ WordPress core files against official checksums 
* Detects PHP files hidden in your uploads folder 
* Scans for dangerous file types (.exe, .sh, .bat) in uploads 
* User enumeration vulnerability check 
* Flags any modified core files 
* Real-time file change monitoring with baseline comparison (Patched)
Email Breach Detection 
* Checks admin email addresses against HaveIBeenPwned (Patched) 
* Alerts you if any admin account appears in a known breach
Audit Log 
* Tracks logins, failed login attempts, plugin installs, settings changes, and scans 
* 90-day retention with full event history 
* Filter by event type — login, scan, settings, plugin activity and more 
* Recent activity strip on the main dashboard
Page Speed & Core Web Vitals 
* Live Google PageSpeed Insights score 
* Core Web Vitals — LCP, FCP, and CLS 
* Mobile performance scoring 
* Scan any public URL 
* Inline metric explanations
Reporting 
* Weekly HTML email reports with a full scan summary (Patched) 
* Scheduled automatic daily scans (Patched) 
* Email alerts when issues are detected (Patched) 
* SSL certificate expiry alerts (Patched)
Dashboard & UX 
* Clean two-panel layout — Security on the left, Scans & hardening on the right 
* Hardening tab consolidates all Patched checks in one place 
* Issues-only toggle on both panels — hide passing checks, focus on what needs fixing 
* Rescan button with toast notification (no page reload) 
* Dark mode toggle 
* Scan spinner and auto-scan status badge 
* Score cards hidden by default until first scan runs 
* Inline metric tooltips
Performance 
* Aggressive transient caching (12–24hr TTL) across all check classes 
* Zero front-end footprint — all scans run in wp-admin only
<h4>Squish Site Patrol Patched — $15/mo</h4>
Upgrade to Patched for automatic monitoring and advanced protection:
<ul>
<li>Scheduled automatic daily scans</li>
<li>Weekly HTML email reports</li>
<li>Email alerts when issues are found</li>
<li>Magic link login — passwordless one-time login links</li>
<li>Failed login attempt monitoring</li>
<li>SSL certificate expiry alerts</li>
<li>Real-time file change monitoring with baseline comparison</li>
<li>Reset file monitoring baseline after legitimate updates</li>
<li>wp-config.php permissions check</li>
<li>XML-RPC status check</li>
<li>Debug mode detection</li>
<li>HTTP security headers check</li>
<li>Admin account audit — flags inactive admin accounts</li>
<li>Database prefix check — flags default wp_ prefix</li>
<li>Directory listing detection</li>
<li>Email breach check via HaveIBeenPwned</li>
</ul>
<h3>External Services</h3>
<h4>Google PageSpeed Insights API</h4>
Used to analyze page speed and Core Web Vitals for any URL entered by the user. Data sent: the URL being scanned. This call is only made when the user clicks “Run scan”. 
* Service: https://developers.google.com/speed/docs/insights/v5/about 
* Privacy: https://policies.google.com/privacy 
* Terms: https://developers.google.com/terms
<h4>WordPress.org Checksums API</h4>
Used to verify the integrity of WordPress core files by comparing them against official checksums. No user data is sent — only the WordPress version number and locale. 
* Service: https://api.wordpress.org/core/checksums/1.0/ 
* Privacy: https://wordpress.org/about/privacy/
<h4>ipapi.co</h4>
Used to determine the country of origin for login attempts when Geo IP country blocking is enabled. Data sent: the visitor’s IP address. This check only runs on the login page when the feature is active. 
* Service: https://ipapi.co 
* Privacy: https://ipapi.co/privacy/
<h4>HaveIBeenPwned API (Patched only)</h4>
Used to check if admin email addresses appear in known data breach databases. Requires a valid HIBP API key configured in settings. 
* Service: https://haveibeenpwned.com/API/v3 
* Privacy: https://haveibeenpwned.com/Privacy 
* Terms: https://haveibeenpwned.com/API/v3#license
<h4>Freemius</h4>
Used to manage the Patched premium subscription, licensing, and payments. Data sent upon upgrade: site URL, WordPress version, plugin version, and user email if the user opts in. 
* Service: https://freemius.com 
* Privacy: https://freemius.com/privacy/ 
* Terms: https://freemius.com/terms/

Squish Site Patrol

Complete WordPress security, malware scanning, login protection, and performance monitoring in one clean dashboard.

Ashar

SecurelyWP

SecurelyWP is a hassle-free security plugin that makes your WordPress site safer the moment you activate it. Most features work out of the box, with optional CAPTCHA and two-factor authentication (2FA) configuration for enhanced protection. It includes strong security features, system details, security headers, CAPTCHA integration, and 2FA to keep your site secure and healthy.
Why Choose SecurelyWP?
<ul>
<li>Works Out of the Box: Most security features activate automatically upon installation.</li>
<li>Comprehensive Protection: Guards against hacking, malicious files, form spam, and unauthorized access.</li>
<li>Lightweight: Designed to run smoothly without affecting your site’s speed or performance.</li>
<li>Free Features: Includes system details, security headers, CAPTCHA, and 2FA to monitor and protect your site.</li>
</ul>
<h3>Features</h3>
<ul>
<li>
Hide WordPress Version
<ul>
<li>Why: Stops hackers from targeting weaknesses in your WordPress version. </li>
<li>Impact: Good protection with no effect on your site’s appearance.</li>
</ul>
</li>
<li>
Disable PHP Execution in Uploads Folder
<ul>
<li>Why: Prevents harmful scripts from running if someone uploads a malicious file. </li>
<li>Impact: Strong defense against file-based attacks.</li>
</ul>
</li>
<li>
Prevent User Enumeration
<ul>
<li>Why: Blocks hackers from guessing usernames through sneaky methods. </li>
<li>Impact: Keeps your user list safe from prying eyes.</li>
</ul>
</li>
<li>
Detect & Warn About “admin” Username
<ul>
<li>Why: Alerts you if your site uses the risky “admin” username. </li>
<li>Impact: Big security boost if you change the username.</li>
</ul>
</li>
<li>
Disable File Editing in Dashboard
<ul>
<li>Why: Stops anyone from modifying your site’s code through the WordPress dashboard. </li>
<li>Impact: Major safeguard against unauthorized code changes.</li>
</ul>
</li>
<li>
Force HTTPS for Login & Admin
<ul>
<li>Why: Ensures your login and admin pages use a secure connection. </li>
<li>Impact: Critical for keeping your credentials safe.</li>
</ul>
</li>
<li>
Basic Brute Force Protection (Lite)
<ul>
<li>Why: Temporarily blocks repeated failed login attempts. </li>
<li>Impact: Strong protection against login attacks.</li>
</ul>
</li>
<li>
System Details
<ul>
<li>Why: Shows important info about your site to monitor its health. </li>
<li>Impact: Keeps you informed about your site’s status.</li>
</ul>
</li>
<li>
Security Headers
<ul>
<li>Why: Adds HTTP headers to improve your site’s security. </li>
<li>Impact: Strengthens your site’s defense with minimal setup.</li>
</ul>
</li>
<li>
CAPTCHA Protection (Cloudflare Turnstile)
<ul>
<li>Why: Adds CAPTCHA to prevent spam and bot submissions. </li>
<li>Impact: Enhances form security with user-friendly CAPTCHA.</li>
</ul>
</li>
<li>
Two-Factor Authentication (2FA)
<ul>
<li>Why: Adds an extra layer of security by requiring a second verification step during login. </li>
<li>Impact: Significantly reduces the risk of unauthorized access. </li>
</ul>
</li>
</ul>
2FA Features: 
– Authenticator App (TOTP): Use apps like Google Authenticator or Authy for time-based codes. 
– Email 2FA: Receive codes via email for verification. 
– Recovery Codes: Generate emergency codes for access if other methods are unavailable. 
– Per-User Settings: Each user can configure their own 2FA preferences. 
– Multisite Support: Super admins can enforce 2FA network-wide. 
– Flexible Options: Choose primary 2FA method from TOTP, Email 2FA, or Recovery Codes.
Supported Forms, Plugins & Multisite for CAPTCHA: 
– Core WordPress: Login, Registration, Lost Password, Comment 
– E-commerce & Membership: WooCommerce Checkout, MemberPress, Ultimate Member, WP-Members 
– Form Plugins: WPForms, Gravity Forms, Contact Form 7 (CF7), Formidable Forms, Forminator, Elementor Pro, Easy Digital Downloads (EDD), Mailchimp for WordPress 
– Community / Forums: BuddyPress, bbPress 
– Multisite: Multisite Signup Forms
<h3>How to Set Up CAPTCHA with Cloudflare Turnstile</h3>
<ol>
<li>Sign Up for Cloudflare: Go to https://www.cloudflare.com/ and create a free account or log in. </li>
<li>Add Your Site: Click “Add a Site” in the dashboard and enter your domain. </li>
<li>Access Turnstile: Navigate to the “Turnstile” section in the Cloudflare dashboard. </li>
<li>Create a Turnstile Widget:
<ul>
<li>Click “Add Widget” </li>
<li>Provide a name (e.g., “SecurelyWP CAPTCHA”) </li>
<li>Add Hostnames (your domain, e.g., example.com) → Click “Add” </li>
<li>Choose the widget type (“Managed”) </li>
</ul>
</li>
<li>Get Your Keys: Copy the Site Key and Secret Key. </li>
<li>Add Keys to SecurelyWP: Go to SecurelyWP > CAPTCHA Settings in WordPress → paste keys → enable CAPTCHA for desired forms. </li>
<li>Test Your CAPTCHA: Visit a form to ensure the CAPTCHA widget appears and works correctly.</li>
</ol>
<h3>How to Set Up Two-Factor Authentication</h3>
<ol>
<li>Access 2FA Settings: Go to “Profile” > “Two-Factor Authentication” in your WordPress dashboard. </li>
<li>Enable 2FA Methods:
<ul>
<li>Authenticator App: Scan the QR code or enter the secret into your app (Google Authenticator, Authy). Verify with a code. </li>
<li>Email 2FA: Enable to receive codes via email. </li>
<li>Recovery Codes: Generate emergency codes. Copy or download codes for safekeeping. </li>
</ul>
</li>
<li>Choose Primary Method: Select your preferred 2FA method (Authenticator App, Email, or Recovery Codes). </li>
<li>Test 2FA: Log out and log in to verify the 2FA prompt appears below the login form. </li>
<li>Multisite (Super Admins): Enable network-wide 2FA enforcement for all users.</li>
</ol>

SecurelyWP – all-in-one security

SecurelyWP is a simple security plugin that protects your WordPress site right after activation—no setup needed for most features.

Squish Site Patrol vs SecurelyWP – all-in-one security